5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability
10news.com
10news.com
"Ocean Beach" is a pleasantly anonymous place name (I can think of several neighborhoods matching this, the U.S. Gazetteer of Places identifies it as Ocean Beach, NY), affording very little by way of actual location.
In an age before widespread Internet use, I experienced similar frustrations while listening to clear channel AM radio broadcasts in the back country. It wasn't uncommon to pull in strong signals from hundreds to a thousand miles away. And while there's something delightfully surreal in listening to the mundania of local traffic and news reports, if you happen to be in a wilderness location trying to find a reliable weather forecast, "area conditions" doesn't do much for you.
Why cannot KGTV note * ON ITS WEBSITE * its geographic affiliation.
Worse is when you run into a newspaper site which flat-out refuses to ID its locale. Where the hell is, without looking it up, the Springfield News-Leader?
(The only hint on the publication's website is its weather forecast).
It's a * WORLD * wide web, folks. Start acting like it.
But they're not a worldwide news service, they are a local one. Why are they obligated to cater to people who don't live in the area they service?
On many sites (including large ones), there's not even a date offered.
Truth is: someone can stumble across a website from literally anywhere on the planet. For those who are in your neighborhood, indicating that you are relevant is useful. Likewise for those who aren't.
They do. Click the "10news" icon, and look at the titlebar.
FYI, Ocean Beach in this case isn't even a town, it's a neighborhood in San Diego, CA. Ocean Beach, NY is a beach town with very, very few permanent residents because it's only accessible by ferry or bicycle.
The onus falls on national/international news outlets to make those clarifications when necessary.
Also, for accurate weather, you should tune your radio accordingly:
http://www.nws.noaa.gov/nwr/nwrbro.htmAnd it's not just news sites -- I once made a service reservation at a Toyota dealership in another state because it had the same name as the one I wanted and no indication of where it was in any global assets (it was buried on a "directions" page).
Not to be "that guy" or anything but I suspect it is pretty normal for a child to hold down a button.
First, what kind of lousy lock wouldn't safeguard against, what was likely either the only or one of a few buttons, being held down?
Second, sounds like proud father has made at least a few false connections. He is a geeky equivalent of a creationist museum tourist.
Years ago (jesus, has it been 15 years?), I was in computer class on the old Macintoshes they had with Mavis Beacon Typing Tutor. We were supposed to type out the sentences we read to increase our typing speed, and learn the home row. I hated home row, and insisted that hunt-and-peck was more comfortable for me. But the teacher was adamant I use home row only, which was annoying. I was also not very fast at either form of typing.
I discovered by accident that if I hit the spacebar for each letter in each word, the program interpreted it as a successful spelling. All I had to do was keep typing the spacebar to complete the words. So i'd put my fingers on the home row, moving my fingers up and down, and pressing the spacebar with my thumb. I got 120 words per minute.
Laziness! Why do I bother writing decent software when there's so much junk floating around that people BUY?
errors = 0
if keypress == ' ':
for i,letter in enumerate(entered_word):
if letter != presented_word[i]:
errors += 1Assuming it's free software, that question answers itself.
Who was sleeping at the wheel when Xbox didn't add empty strings to password verification checks?
Kristoffer will receive four games, $50 and a year-long
subscription to Xbox Live from Microsoft.They paid him at all, which is good, but it also shows that there's no reason they couldn't have authorized a bigger payout. It's still, at most, $350. Why not free Xbox Gold for life instead of one year? There's no cost to Microsoft.
It just goes to show (if my assumption is correct) that it's worth NOT adding in those efficiencies, when possible, because of situations just like this one.
#ifdef DEBUG
... code ...
#endif #ifdef DEBUG
if (pw == "backdoor")
return true;
#endif
I'm not really a C developer, but since it's a lingua franca, GCC lets you pass in -D (name), which will define that passed in as a macro, letting you do stuff like
#ifdef DEBUG
//Do debug stuff
#endif
Java, I don't believe javac has a similar compiler mechanism; you either need a hardcoded global value in the source code
public static final boolean DEBUG = true;
if DEBUG { (...) }
For any other language, consult your documentation. If there's nothing else, and the language allows you to pass in arguments into the runtime executable, you could always do something really ungainly like accept an argument for 'environment', and have code that executes differently based on that. It's a minimal cost (since any given run will lead to that particular switch always executing the same way, I'd wager your CPUs branch prediction is going to effectively make it free, but even if it doesn't, it's minimal impact), and it lets you execute the code differently based on what environment you specify you're in.
To me it seems more plausible that the verification answer was a series of spaces. Perhaps the bounty was paid for noticing insecure verification answers weren't rejected?
[1]: http://lifehacker.com/5733535/use-spaces-in-your-windows-pas...
Really the whole thing reminds me about how I used to break the parental locks on my TV as a kid. I doubt this kid was the first to discover this, but probably because of the work his father does, they were able to make the right right calls and send the right emails.
Conjecture here, but maybe the code checks the length as greater than 0, and then trims the string. Depending on how the string comparison is performed, that empty string might pass.
This can't be the Xbox Live account password, because surely that is sending hashes over the wire and not plaintext. Maybe the parental controls don't have the same kind of security, but I don't know that it is needed.
§ 156.10 Computer trespass.
A person is guilty of computer trespass when he or she knowingly uses,
causes to be used, or accesses a computer, computer service, or computer
network without authorization and:
1. he or she does so with an intent to commit or attempt to commit or
further the commission of any felony; or
2. he or she thereby knowingly gains access to computer material.
Computer trespass is a class E felony.
That being said, this is hardly a triable case as the defendant is 5 years old. The DA would have to prove that the kid knew what he was doing enough to have the culpability to commit a crime, then they would have to convince a jury of adults that a kid should face criminal consequences for hacking his dad's xbox account.
> At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key.
... uh ... pretty sure because that's because he watched his father doing in order to use the phone.
As an aside, this gave me an idea: Grey hat SEO/reputation consulting for your kids' reputations.
In this case, inexplicably, it worked.
Given the kid's history of interesting discoveries, I'd say this is legit. It's not very sophisticated, but it sure is effective. If your father was someone trained to probe for problems, if you'd grown up with that sort of encouragement, you'd probably try the same thing at your own level of ability.
Props to the kid!